Changeset 0e389d13


Ignore:
Timestamp:
10/26/2014 02:55:55 PM (10 years ago)
Author:
Krejzi <krejzi@…>
Branches:
krejzi/svn
Children:
169031f
Parents:
cb9c6940
Message:

More conversion.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd-ng@14740 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:
4 edited
7 moved

Legend:

Unmodified
Added
Removed

  • introduction/welcome/changelog.xml

    rcb9c6940 r0e389d13  
    5252        </listitem>
    5353        <listitem>
     54          <para>[krejzi] - Converted Cyrus-SASL, Firewalling, Haveged, Iptables, MIT Kerberos V5, OpenSSH and Stunnel instructions to work on systemd setups.</para>
     55        </listitem>
     56        <listitem>
    5457          <para>[krejzi] - Converted Polkit instructions to use systemd-logind.</para>
    5558        </listitem>

  • postlfs/security/cyrus-sasl-systemd.xml

    rcb9c6940 r0e389d13  
    102102      <xref linkend="linux-pam"/>,
    103103      <xref linkend="mitkrb"/>,
    104       <xref linkend="mariadb"/> or <ulink url="http://www.mysql.com/">MySQL</ulink>,
     104      <xref linkend="mariadb"/>,
    105105      <xref linkend="openjdk"/>,
    106106      <xref linkend="openldap"/>,
    … …  
    177177
    178178    <para>
    179       <option>--with-dblib=gdbm</option>: This switch forces
     179      <parameter>--with-dblib=gdbm</parameter>: This switch forces
    180180      <application>GDBM</application> to be used instead of
    181181      <application>Berkeley DB</application>.
    … …  
    268268
    269269    <sect3 id="cyrus-sasl-init">
    270       <title>Init Script</title>
     270      <title>Systemd Units</title>
    271271
    272272      <para>
    273         If you need to run the <command>saslauthd</command> daemon at system
    274         startup, install the <filename>/etc/rc.d/init.d/saslauthd</filename>
    275         init script included in the <xref linkend="bootscripts"/>
    276         package using the following command:
     273        To start the <command>saslauthd</command> daemon at boot,
     274        install the systemd unit from the <xref linkend="bootscripts"/>
     275        package by running the following command as the
     276        <systemitem class="username">root</systemitem> user:
    277277      </para>
    278278
    … …  
    285285      <note>
    286286        <para>
    287           You'll need to modify /etc/sysconfig/saslauthd and replace the
    288           <option><replaceable>AUTHMECH</replaceable></option> parameter
    289           with your desired authentication mechanism.
     287          The default authentication method is "shadow". The
     288          <filename>/etc/default/saslauthd</filename>
     289          file needs to be modified for anything else.
    290290        </para>
    291291      </note>

  • postlfs/security/firewalling-systemd.xml

    rcb9c6940 r0e389d13  
    141141    </caution>
    142142
    143     <para>The firewall configuration script installed in the iptables section
    144     differs from the standard configuration script. It only has two of
    145     the standard targets: start and status. The other targets are clear
    146     and lock. For instance if you issue:</para>
    147 
    148 <screen role="root"><userinput>/etc/rc.d/init.d/iptables start</userinput></screen>
    149 
    150     <para>the firewall will be restarted just as it is upon system startup.
    151     The status target will present a list of all currently implemented
    152     rules. The clear target turns off all firewall rules and the lock
    153     target will block all packets in and out of the computer with the
    154     exception of the loopback interface.</para>
    155 
    156143    <para>The main startup firewall is located in the file
    157     <filename>/etc/rc.d/rc.iptables</filename>. The sections below provide
     144    <filename>/etc/systemd/scripts/iptables</filename>. The sections below provide
    158145    three different approaches that can be used for a system.</para>
    159146
    … …  
    178165      to the Linux 2.6 kernels.</para>
    179166
    180 <screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
     167<screen role="root"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
     168
     169cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
    181170<literal>#!/bin/sh
    182171
    183 # Begin rc.iptables
     172# Begin /etc/systemd/scripts/iptables
    184173
    185174# Insert connection-tracking modules
    … …  
    250239iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
    251240
    252 # End $rc_base/rc.iptables</literal>
     241# End /etc/systemd/scripts/iptables</literal>
    253242EOF
    254 chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
     243chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
    255244
    256245      <para>This script is quite simple, it drops all traffic coming
    … …  
    284273      a worm via a buffer-overflow).</para>
    285274
    286 <screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
     275<screen role="root"><?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts
     276
     277cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
    287278<literal>#!/bin/sh
    288279
    289 # Begin rc.iptables
     280# Begin /etc/systemd/scripts/iptables
    290281
    291282echo
    … …  
    371362
    372363# Enable IP Forwarding
    373 echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
     364echo 1 &gt; /proc/sys/net/ipv4/ip_forward
     365
     366# End /etc/systemd/scripts/iptables</literal>
    374367EOF
    375 chmod 700 /etc/rc.d/rc.iptables</userinput></screen>
     368chmod 700 /etc/systemd/scripts/iptables</userinput></screen>
    376369
    377370      <para>With this script your intranet should be reasonably secure

  • postlfs/security/gnutls.xml

    rcb9c6940 r0e389d13  
    111111      <xref linkend="unbound"/> (to build the DANE library),
    112112      <xref linkend="valgrind"/> (used during the test suite),
    113       <ulink url="http://ftp.gnu.org/gnu/autogen/">autogen</ulink>, and
     113      <ulink url="http://ftp.gnu.org/gnu/autogen/">Autogen</ulink>, and
    114114      <ulink url="http://sourceforge.net/projects/trousers/files/trousers/">Trousers</ulink> (Trusted Platform Module support)
    115115    </para>
    … …  
    134134    </para>
    135135
    136 <screen><userinput>./configure --prefix=/usr \
    137             --with-default-trust-store-file=/etc/ssl/ca-bundle.crt &amp;&amp;
     136<screen><userinput>./configure --prefix=/usr &amp;&amp;
    138137make</userinput></screen>
    139138
    … …  
    163162  <sect2 role="commands">
    164163    <title>Command Explanations</title>
    165 
    166     <para>
    167       <parameter>--with-default-trust-store-file=/etc/ssl/ca-bundle.crt</parameter>:
    168       This switch tells <command>configure</command> where to find the
    169       CA Certificates.
    170     </para>
    171164
    172165    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
    … …  
    191184          libgnutls.so, libgnutls-dane.so,
    192185          libgnutls-openssl.so, libgnutlsxx.so, and
    193           /usr/lib/guile/2.0/guile-gnutls-v-2.so
     186          guile-gnutls-v-2.so (<application>Guile</application> Module
    194187        </seg>
    195188        <seg>

  • postlfs/security/haveged-systemd.xml

    rcb9c6940 r0e389d13  
    104104
    105105    <sect3  id="haveged-init">
    106       <title>Boot Script</title>
     106      <title>Systemd Units</title>
    107107
    108108      <para>
    109         If you want the <application>Haveged</application> daemon to
    110         start automatically when the system is booted, install the
    111         <filename>/etc/rc.d/init.d/haveged</filename> init script included
    112         in the <xref linkend="bootscripts"/> package.
     109        To start the <command>haveged</command> daemon at boot,
     110        install the systemd unit from the <xref linkend="bootscripts"/>
     111        package by running the following command as the
     112        <systemitem class="username">root</systemitem> user:
    113113      </para>
    114114

  • postlfs/security/iptables-systemd.xml

    rcb9c6940 r0e389d13  
    181181
    182182    <sect3  id="iptables-init">
    183       <title>Boot Script</title>
     183      <title>Systemd Units</title>
    184184
    185185      <para>
    186         To set up the iptables firewall at boot, install the
    187         <filename>/etc/rc.d/init.d/iptables</filename> init script included
    188         in the <xref linkend="bootscripts"/> package.
     186        To set up the <application>Iptables</application> firewall at boot,
     187        install the systemd unit from the <xref linkend="bootscripts"/>
     188        package by running the following command as the
     189        <systemitem class="username">root</systemitem> user:
    189190      </para>
    190191

  • postlfs/security/mitkrb-systemd.xml

    rcb9c6940 r0e389d13  
    123123    <para>You will probably see output similar to:</para>
    124124
    125 <screen><literal>gpg: Signature made Mon Aug 11 22:53:10 2014 GMT using RSA key ID 749D7889
     125<screen><literal>gpg: Signature made Thu 16 Oct 2014 02:02:43 AM CEST using RSA key ID 749D7889
    126126gpg: Can't check signature: No public key</literal></screen>
    127127
    … …  
    148148    -e "s@-lpython2.5]@&amp;,\n  AC_CHECK_LIB(python2.7,main,[PYTHON_LIB=-lpython2.7])@g" \
    149149    -i configure.in &amp;&amp;
    150 sed -e 's@\^u}@^u cols 300}@' \
    151     -i tests/dejagnu/config/default.exp &amp;&amp;
    152150autoconf &amp;&amp;
    153151./configure --prefix=/usr            \
    … …  
    156154            --with-system-et         \
    157155            --with-system-ss         \
    158             --with-system-verto=no   \
    159             --enable-dns-for-realm &amp;&amp;
     156            --without-system-verto   \
     157            --enable-dns-for-realm   &amp;&amp;
    160158make</userinput></screen>
    161159
    … …  
    178176for LIBRARY in gssapi_krb5 gssrpc k5crypto kadm5clnt kadm5srv \
    179177               kdb5 kdb_ldap krad krb5 krb5support verto ; do
    180     chmod -v 755 /usr/lib/lib$LIBRARY.so
    181 done          &amp;&amp;
     178    [ -e  /usr/lib/lib$LIBRARY.so ] &amp;&amp; chmod -v 755 /usr/lib/lib$LIBRARY.so
     179done &amp;&amp;
    182180unset LIBRARY &amp;&amp;
    183181
    184 mv -v /usr/lib/libkrb5.so.3*        /lib &amp;&amp;
    185 mv -v /usr/lib/libk5crypto.so.3*    /lib &amp;&amp;
    186 mv -v /usr/lib/libkrb5support.so.0* /lib &amp;&amp;
    187 
    188 ln -v -sf ../../lib/libkrb5.so.3.3        /usr/lib/libkrb5.so        &amp;&amp;
    189 ln -v -sf ../../lib/libk5crypto.so.3.1    /usr/lib/libk5crypto.so    &amp;&amp;
    190 ln -v -sf ../../lib/libkrb5support.so.0.1 /usr/lib/libkrb5support.so &amp;&amp;
     182mv -v /usr/lib/libkrb5.so.*        /lib &amp;&amp;
     183mv -v /usr/lib/libk5crypto.so.*    /lib &amp;&amp;
     184mv -v /usr/lib/libkrb5support.so.* /lib &amp;&amp;
     185
     186ln -sfv ../../lib/$(readlink /usr/lib/libkrb5.so)        /usr/lib/libkrb5.so        &amp;&amp;
     187ln -sfv ../../lib/$(readlink /usr/lib/libk5crypto.so)    /usr/lib/libk5crypto.so    &amp;&amp;
     188ln -sfv ../../lib/$(readlink /usr/lib/libkrb5support.so) /usr/lib/libkrb5support.so &amp;&amp;
    191189
    192190mv -v /usr/bin/ksu /bin &amp;&amp;
    … …  
    194192
    195193install -v -dm755 /usr/share/doc/krb5-&mitkrb-version; &amp;&amp;
    196 cp -vfr ../doc/*  /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
     194cp -rfv ../doc/*  /usr/share/doc/krb5-&mitkrb-version;</userinput></screen>
    197195
    198196
    … …  
    204202    <para>
    205203      <command>sed -e ...</command>: The first <command>sed</command> fixes
    206       <application>Python</application> detection. The second one increases
     204      <application>Python</application> detection.<!-- The second one increases
    207205      the width of the virtual terminal used for some tests, to prevent
    208       some spurious characters to be echoed, which is taken as a failure.
    209     </para>
    210 
    211     <para>
    212       <parameter>--localstatedir=/var/lib</parameter>: This parameter is
     206      some spurious characters to be echoed, which is taken as a failure. -->
     207    </para>
     208
     209    <para>
     210      <parameter>--localstatedir=/var/lib</parameter>: This switch is
    213211      used so that the Kerberos variable run-time data is located in
    214212      <filename class="directory">/var/lib</filename> instead of
    … …  
    229227
    230228    <para>
    231       <parameter>--with-system-verto=no</parameter>: This switch fixes a bug in
    232       the package: it does not recognize its own verto library installed
    233       previously. This is not a problem, if reinstalling the same version,
    234       but if you are updating, the old library is used as system's one,
    235       instead of installing the new version.
     229      <parameter>--without-system-verto</parameter>: This switch causes
     230      the build to use the internal version of <filename
     231      class="libraryfile">libverto</filename> library in case older one
     232      is present from previous <application>Kerberos</application>
     233      installation.
    236234    </para>
    237235
    … …  
    458456
    459457    <sect3 id="mitkrb-init">
    460       <title>Init Script</title>
     458      <title>Systemd Units</title>
    461459
    462460      <para>
    463         If you want to start <application>Kerberos</application> services
    464         at boot, install the <filename>/etc/rc.d/init.d/krb5</filename> init
    465         script included in the <xref linkend="bootscripts"/> package using
    466         the following command:
     461        To start the Kerberos services at boot,
     462        install the systemd units from the <xref linkend="bootscripts"/>
     463        package by running the following command as the
     464        <systemitem class="username">root</systemitem> user:
    467465      </para>
    468466
    … …  
    496494        </seg>
    497495        <seg>
    498           libgssapi_krb5.so, libgssrpc.so, libk5crypto.so, libkadm5clnt_mit.so,
    499           libkadm5clnt.so, libkadm5srv_mit.so, libkadm5srv.so, libkdb_ldap.so
    500           (optional), libkdb5.so, libkrad.so, libkrb5.so, libkrb5support.so,
    501           libverto.so, and some plugins under the /usr/lib/krb5 tree
     496          libgssapi_krb5.so, libgssrpc.so, libk5crypto.so,
     497          libkadm5clnt.so, libkadm5srv.so, libkdb5.so, libkdb_ldap.so
     498          (optional), libkrad.so, libkrb5.so, libkrb5support.so, and
     499          libverto.so
    502500        </seg>
    503501        <seg>
    … …  
    508506          /usr/lib/krb5,
    509507          /usr/share/doc/krb5-&mitkrb-version;,
    510           /usr/share/examples/krb5,
    511           /usr/share/gnats/, and
     508          /usr/share/examples/krb5 and
    512509          /var/lib/krb5kdc
    513510        </seg>

  • postlfs/security/openssh-systemd.xml

    rcb9c6940 r0e389d13  
    8383    <para role="required">
    8484      <xref linkend="openssl"/> or
    85       <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink></para>
     85      <ulink url="http://www.libressl.org/">LibreSSL Portable</ulink>
     86    </para>
    8687
    8788    <bridgehead renderas="sect4">Optional</bridgehead>
    … …  
    302303
    303304    <sect3  id="openssh-init">
    304       <title>Boot Script</title>
    305 
    306       <para>
    307         To start the SSH server at system boot, install the
    308       <filename>/etc/rc.d/init.d/sshd</filename> init script included
    309       in the <xref linkend="bootscripts"/> package.
    310         </para>
     305      <title>Systemd Units</title>
     306
     307      <para>
     308        To start the <command>sshd</command> daemon at boot,
     309        install the systemd units from the <xref linkend="bootscripts"/>
     310        package by running the following command as the
     311        <systemitem class="username">root</systemitem> user:
     312      </para>
    311313
    312314      <indexterm zone="openssh openssh-init">
    … …  
    315317
    316318<screen role="root"><userinput>make install-sshd</userinput></screen>
     319
     320      <note>
     321        <para>
     322          This package comes with two types of units: A service file and a socket file.
     323          The service file will start sshd daemon once at boot and it will keep running until the
     324          system shuts down. The socket file will make systemd listen on sshd port (Default 22, needs
     325          to be edited for anything else) and will start sshd daemon when something tries to connect
     326          to that port and stop the daemon when the connection is terminated. This is
     327          called socket activation.
     328
     329          By default, the first method is used - sshd daemon is started at boot and stopped at shutdown.
     330          If the socket method is desired, you need to run as the
     331          <systemitem class="username">root</systemitem> user:
     332
     333<screen role="root"><userinput>systemctl stop sshd &amp;&amp;
     334systemctl disable sshd &amp;&amp;
     335systemctl enable sshd.socket &amp;&amp;
     336systemctl start sshd.socket</userinput></screen>
     337        </para>
     338      </note>
     339
    317340    </sect3>
    318341  </sect2>
    … …  
    336359        <seg>
    337360          /etc/ssh,
     361          /usr/libexec/openssh,
    338362          /usr/share/doc/openssh-&openssh-version;, and
    339363          /var/lib/sshd

  • postlfs/security/security.xml

    rcb9c6940 r0e389d13  
    4444  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cacerts.xml"/>
    4545  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cracklib.xml"/>
    46   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cyrus-sasl.xml"/>
     46  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="cyrus-sasl-systemd.xml"/>
    4747  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gnupg2-systemd.xml"/>
    4848  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gnutls.xml"/>
    4949  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="gpgme.xml"/>
    50   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="haveged.xml"/>
    51   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables.xml"/>
    52   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling.xml"/>
     50  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="haveged-systemd.xml"/>
     51  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="iptables-systemd.xml"/>
     52  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="firewalling-systemd.xml"/>
    5353  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="libcap-systemd.xml"/>
    5454  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="linux-pam.xml"/>
    55   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="mitkrb.xml"/>
     55  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="mitkrb-systemd.xml"/>
    5656  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nettle.xml"/>
    5757  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nss.xml"/>
    58   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="openssh.xml"/>
     58  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="openssh-systemd.xml"/>
    5959  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="openssl.xml"/>
    6060  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="p11-kit.xml"/>
    … …  
    6262  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="shadow.xml"/>
    6363  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="ssh-askpass.xml"/>
    64   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="stunnel.xml"/>
     64  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="stunnel-systemd.xml"/>
    6565  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="sudo.xml"/>
    6666  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="tripwire.xml"/>

  • postlfs/security/shadow.xml

    rcb9c6940 r0e389d13  
    631631    <para>
    632632      A list of the installed files, along with their short descriptions can be
    633       found at <ulink url="http://www.linuxfromscratch.org/lfs/view/&lfs-version;/chapter06/shadow.html#contents-shadow"/>.
     633      found at <ulink url="&lfs-root;/chapter06/shadow.html#contents-shadow"/>.
    634634    </para>
    635635

  • postlfs/security/stunnel-systemd.xml

    rcb9c6940 r0e389d13  
    114114    </note>
    115115
     116    <para>
     117      Fix the bundled systemd unit so it does not use a deprecated dependency:
     118    </para>
     119
     120<screen><userinput>sed -i /syslog.target/d tools/stunnel.service.in</userinput></screen>
     121
    116122    <para>Install <application>stunnel</application> by running the following
    117123    commands:</para>
    … …  
    127133
    128134<screen role="root"><userinput>make docdir=/usr/share/doc/stunnel-&stunnel-version; install</userinput></screen>
     135
     136    <para>
     137      Install the systemd unit by running the following command as the
     138      <systemitem class="username">root</systemitem> user:
     139    </para>
     140
     141<screen role="root"><userinput>install -v -m644 tools/stunnel.service /lib/systemd/system/stunnel.service</userinput></screen>
    129142
    130143    <para>To create the <filename>stunnel.pem</filename> in the
    … …  
    229242
    230243    <sect3  id="stunnel-init">
    231       <title>Boot Script</title>
    232 
    233       <para>To automatically start the <command>stunnel</command> daemon
    234       when the system is rebooted, install the
    235       <filename>/etc/rc.d/init.d/stunnel</filename> bootscript from the
    236       <xref linkend="bootscripts"/> package.</para>
     244      <title>Systemd Units</title>
     245
     246      <para>
     247        To start the <command>stunnel</command> daemon at boot,
     248        enable the previously installed systemd unit by
     249        running the following command as the
     250        <systemitem class="username">root</systemitem> user:
     251      </para>
    237252
    238253      <indexterm zone="stunnel stunnel-init">
    … …  
    240255      </indexterm>
    241256
    242 <screen role="root"><userinput>make install-stunnel</userinput></screen>
     257<screen role="root"><userinput>systemctl enable stunnel</userinput></screen>
    243258
    244259    </sect3>
Note: See TracChangeset for help on using the changeset viewer.